I've received a rejection for using a "private" ivar (it was actually a framework doing it).
The ivar was in a public header, and was not marked @private, which is the only correct way to designated an ivar as private in Objective-C. Putting a comment above it saying "this is private" (which they did) doesn't count. It's protected, by definition.
NSActionCell.h, I think.